-
Notifications
You must be signed in to change notification settings - Fork 41
Expand file tree
/
Copy pathdocker-compose.yml
More file actions
175 lines (175 loc) · 8.58 KB
/
Copy pathdocker-compose.yml
File metadata and controls
175 lines (175 loc) · 8.58 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
version: '3'
services:
api:
container_name: api
image: rcbj/api
environment:
- CONFIG_FILE=./env/local.js
- TLS_ENABLED=true
- TLS_CERT_FILE=/etc/idptools/tls/stack-tls-cert.pem
- TLS_KEY_FILE=/etc/idptools/tls/stack-tls-key.pem
# ---------------------------------------------------------------------
# THE STACK'S TLS PAIR.
#
# `client/src/env/local.js` and `api/env/local.js` both set `https: true`,
# so these two services serve TLS and need a certificate. THIS compose
# file has no launcher in front of it — the repo-root CLAUDE.md documents
# `CONFIG_FILE=./env/local.js docker-compose up` as a bare command — so
# generate the pair once, first:
#
# ./generate-tls-cert.sh
#
# It writes ./generated-tls, which is what this mounts and what
# .gitignore already covers. Without it compose creates that path as an
# EMPTY directory and both services exit at startup naming the file they
# could not read — the same shape as the walt.id `generated-*-config`
# hazard this repository already records, and the message names the
# generator.
# ---------------------------------------------------------------------
volumes:
- ${STACK_TLS_DIR:-./generated-tls}:/etc/idptools/tls:ro
build:
context: .
dockerfile: ./api/Dockerfile
args:
CONFIG_FILE: ${CONFIG_FILE}
# Optional: CI fixes the build number so the image and the git tag agree.
# Unset locally -> version.js falls back to the UTC build instant.
BUILD_NUMBER: ${BUILD_NUMBER:-}
GIT_COMMIT: ${GIT_COMMIT:-}
ports:
- "4000:4000"
client:
container_name: client
image: rcbj/client
environment:
- CONFIG_FILE=./env/local.js
- TLS_ENABLED=true
- TLS_CERT_FILE=/etc/idptools/tls/stack-tls-cert.pem
- TLS_KEY_FILE=/etc/idptools/tls/stack-tls-key.pem
# ---------------------------------------------------------------------
# THE STACK'S TLS PAIR.
#
# `client/src/env/local.js` and `api/env/local.js` both set `https: true`,
# so these two services serve TLS and need a certificate. THIS compose
# file has no launcher in front of it — the repo-root CLAUDE.md documents
# `CONFIG_FILE=./env/local.js docker-compose up` as a bare command — so
# generate the pair once, first:
#
# ./generate-tls-cert.sh
#
# It writes ./generated-tls, which is what this mounts and what
# .gitignore already covers. Without it compose creates that path as an
# EMPTY directory and both services exit at startup naming the file they
# could not read — the same shape as the walt.id `generated-*-config`
# hazard this repository already records, and the message names the
# generator.
# ---------------------------------------------------------------------
volumes:
- ${STACK_TLS_DIR:-./generated-tls}:/etc/idptools/tls:ro
build:
context: .
dockerfile: ./client/Dockerfile
args:
CONFIG_FILE: ${CONFIG_FILE}
# Optional: CI fixes the build number so the image and the git tag agree.
# Unset locally -> version.js falls back to the UTC build instant.
BUILD_NUMBER: ${BUILD_NUMBER:-}
GIT_COMMIT: ${GIT_COMMIT:-}
ports:
- "3000:3000"
sts:
environment:
# Log level, chosen the same way as for api and client.
- CONFIG_FILE=./env/local.js
# THE ADDRESS THE MOCK HANDS THE END-USER BACK TO, and it has to be set
# here now rather than left to that service's default. mock-sts's own
# `oid4vci.walletUrl` defaults to `http://localhost:3000`, which was
# this client's address until it started serving TLS; left alone, a
# Credential Offer would send the End-User to an http origin nothing is
# listening on. The submodule is somebody else's checkout, so the fix
# belongs on this side. `oid4vp.walletUrl` is DERIVED from this one (see
# sts/common/config.js), so the verifier's hand-back follows.
- OID4VCI_WALLET_URL=https://localhost:3000
# ---------------------------------------------------------------------
# THE SAME LEAF THE API AND THE CLIENT SERVE, WHICH IS ONE TRUST
# DECISION INSTEAD OF THREE.
#
# Left alone this service issues its own self-signed certificate at
# every start and publishes it from GET /tls/server-certificate for a
# caller to trust. That works and it costs a SECOND anchor, on a THIRD
# origin, replaced on every restart. ./generate-tls-cert.sh now issues
# the stack's leaf from a Root CA that outlives it, and the leaf's
# subjectAltNames already carry this service's own tls.hostnames
# defaults (sts, sts-mock, sts.example.com) beside localhost, client and
# api — so handing it the same files makes ONE trusted root cover the
# UI, the api and the mock at once.
#
# It covers all four of this process's TLS sockets, because they share
# one pair: 8081 (the main port under global.https), 8443, 9443 and the
# directory's LDAPS listener on 636.
# ---------------------------------------------------------------------
- STS_TLS_CERT_FILE=/etc/idptools/tls/stack-tls-cert.pem
- STS_TLS_KEY_FILE=/etc/idptools/tls/stack-tls-key.pem
# ---------------------------------------------------------------------
# THE MANAGEMENT API'S CLIENT SECRET, PINNED FOR THIS RUN.
#
# `/admin-api` takes an OAuth 2.0 access token since the 2026-09-09
# submodule bump, minted by the seeded `sts-management-api` client with
# client_credentials. That client's secret is generated at every start
# of this service and is readable only THROUGH the API it unlocks — a
# bootstrap hole — so `adminApi.clientSecret` exists to pin it.
# common/common.sh generates one per launcher run and forwards it; a
# bare `docker-compose up` leaves it empty, which is this service's own
# default and means a `/admin-api` nothing here can reach. Set it, or
# set ADMIN_API_AUTH_REQUIRED=false, if you want in from a shell.
# ---------------------------------------------------------------------
- ADMIN_API_CLIENT_SECRET=${ADMIN_API_CLIENT_SECRET:-}
volumes:
- ${STACK_TLS_DIR:-./generated-tls}:/etc/idptools/tls:ro
container_name: sts
image: rcbj/sts
# ROOT, and the only container here that is. It binds 88 (TCP and UDP),
# 389 and 636 — all privileged — so it needs uid 0 or
# CAP_NET_BIND_SERVICE; and sts/ is the mock-sts submodule, somebody
# else's checkout. Every image THIS repository builds now runs as an
# unprivileged user; see the block at the foot of each Dockerfile.
build:
# sts/ is a submodule (https://github.com/rcbj/mock-sts.git, branch main),
# and its Dockerfile's COPY paths are relative to ITS root — so the context
# is the submodule, not this repository. An uninitialised submodule leaves
# sts/ empty and compose then reports only "failed to read dockerfile";
# common/common.sh's requireMockStsCheckout() is what turns that into an
# explanation, and the launchers call it before building.
context: ./sts
ports:
- "8081:8081"
# The mock's TLS endpoint, which is not on the HTTP port because it is not
# HTTP on that listener: 8443 asks for a client certificate and never
# refuses one, 9443 requires it. The PKI page's TLS pane points at these,
# through the api — a browser cannot present a certificate it just issued.
# Both are in api/tls_probe.js's default port allowlist already.
- "8443:8443"
- "9443:9443"
# The two SPIFFE gRPC surfaces. Published for the same reason 8443 and
# 9443 are: a tool run on the host — including an api started outside
# compose — cannot reach a port that only exists on the bridge. The api
# container beside this one reaches them as sts:8092 and sts:8181 and
# needs neither line. They are 8092 and 8181 rather than SPIRE's own
# 8081 because this service's HTTP port already has that.
- "8092:8092"
- "8181:8181"
# Keycloak 8.0.1 + cloudtrust keycloak-wsfed module (WS-Federation IdP side-car
# for the WS-Fed test). Included here so the Docker Image CI (dockerimage.yml,
# which runs `docker-compose -f docker-compose.yml build`) builds it too.
keycloak-wsfed:
container_name: keycloak-wsfed
image: rcbj/keycloak-wsfed
build:
context: .
dockerfile: ./keycloak-wsfed/Dockerfile
environment:
KEYCLOAK_USER: keycloak
KEYCLOAK_PASSWORD: keycloak
ports:
- "8082:8080"